v1.20.5

1. Security

Elixir

• [URI] Bind port limits during URI.parse (CVE-2026-109821)
• [JSON] Raise when decoding integers in JSON beyond float64 ranges (CVE-2026-115274)

Mix

• [mix deps.partition] Validate deps.partition configuration with checksum on multi-user systems (CVE-2026-97209)

2. Enhancements

Elixir

• [Calendar.ISO] Optimize Calendar.ISO.parse_duration/1
• [Kernel] Improve boot time by parsing the Erlang/OTP release with list_to_integer/1

3. Bug fixes

Elixir

• [Date] Fix Date.from_gregorian_days/2 passing an invalid day fraction to non-ISO calendars
• [Duration] Fix Duration.from_iso8601/1 accepting a fractional seconds component after whole seconds, such as PT1S2.5S
• [Duration] Reject inputs longer than 192 bytes in Duration.from_iso8601/1
• [Regex] Raise SystemLimitError when a match reaches the regex engine match limit, instead of returning no match
• [Registry] Do not crash on timeouts on Registry.lock/3
• [String] Skip U+055F (Armenian abbreviation mark) when applying the Greek final sigma rule in String.downcase/2 and String.capitalize/2
• [Task] Do not leak timeout messages on Task.async_stream/3

IEx

• [IEx] Do not halt the remote node when the remote shell receives EOF with --remsh
• [IEx] Fix crash on tab completion when shell is not found

Mix

• [mix xref] Fix outgoing compile-connected counts in mix xref graph --format stats